ONX-14

Bridge

Traffic between ONYX and its connectors is encrypted end to end, inside the TLS. TLS terminates at the load balancer; from there to the process it would travel in the clear.

Opening the connectionPUE-0255

ARGOS                                        ONYX
  ──  1  ·   53 B  ─────────────────────────►
  ◄──  2  ·  160 B  ──────────────────────
  ──  3  ·  112 B  ─────────────────────────►
  ════════════════════════════════════════════

What it protectsAMZ-0256

attack	what stops it
Reading the traffic	ChaCha20-Poly1305 with a key that exists only for that session.
Storing it to decrypt once the key is stolen	Session keys are created and destroyed with the session. The identity key signs, it does not decrypt.
Replaying a captured message	Every message is numbered. Repeats are dropped.
Impersonating ONYX	Its public key ships inside the connector. It is never downloaded.
Learning who is talking	Identities travel encrypted inside the exchange.
Flooding the server with connections	A token tied to the source address is required before any crypto.

Example connectionVIV-0257

This page opens a real connection when it loads. The sizes are the real ones.

1 · Greeting

53 B

2 · Response

160 B

3 · Identification

112 B

Session identifier

7ddf8cc852dabb0c8cef98728b8b46ee

One encrypted message, as it goes on the wire:

00000000000000015ce22d9a4c570ae4d3639b8343efda080b27480c
febd33a69c1335367a55528c4b97495fbb9218d9

That block contains the phrase "this link is clean". Without the session key it cannot be read.